04ab7b98b1b1c92482545f2ec33523dde3e369c894d9b552c62231cc3e0678ec

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 04:35

Target

4cd1d332d2f6e4a3eb7072be5c19c618_JaffaCakes118.dll
Size

167KB
MD5

4cd1d332d2f6e4a3eb7072be5c19c618
SHA1

4cc12f29e93b068e2db39f7a33319409aee99576
SHA256

04ab7b98b1b1c92482545f2ec33523dde3e369c894d9b552c62231cc3e0678ec
SHA512

020ff6857d2488b75859f029eb88d1b3e2807d727a951b7b4c4ecc9196e743e608e95863c929b558eb813afdd5265df7ffceb261b3cdf5a8c557857348befdf9
SSDEEP

3072:apoue6JBetB8D+ly+xLV6KCzE7fQ6haM:apzTBeQyxh6KCzE79

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	4908	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4908	3592	regsvr32.exe	84
PID 3592 wrote to memory of 4908	3592	regsvr32.exe	84
PID 3592 wrote to memory of 4908	3592	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4cd1d332d2f6e4a3eb7072be5c19c618_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4cd1d332d2f6e4a3eb7072be5c19c618_JaffaCakes118.dll
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 604
    3⤵
    - Program crash
    PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4908 -ip 4908
1⤵
PID:4488

memory/4908-1-0x0000000000445000-0x0000000000446000-memory.dmp

Filesize
4KB

Download
memory/4908-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download